BEFORE‌ ‌

‌
THE‌‌HON’BLE‌‌SUPREME‌‌COURT‌‌OF‌‌INDISTHAN‌ ‌
‌
‌
‌
‌
‌
‌
CRIMINAL‌‌APPELLATE‌‌JURISDICTION‌ ‌
‌
‌
‌
Criminal‌‌Appeal‌‌No.‌‌001‌‌of‌‌2021‌ ‌
‌
INFINITY‌‌ANALYTICS‌‌&‌‌PROF.‌‌WALTER‌‌STEFAN‌‌.......................‌‌Appellants‌ ‌
‌V‌ ‌
‌UNION‌‌OF‌‌INDISTHAN...................................................‌‌Respondent‌ ‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
BENCH‌ ‌
JUSTICE‌‌JISHIN‌‌JAFAR‌‌T‌‌&‌‌KISHORE‌‌RAJ‌‌R.S‌ ‌
 STATEMENT‌‌OF‌‌FACTS‌ ‌
‌
Infinity‌ ‌Analytics‌ ‌is‌ ‌a‌ ‌French‌ ‌firm‌ ‌and‌ ‌well-known‌ ‌for‌ ‌data‌ ‌analytics‌ ‌and‌‌
consulting‌ ‌services.‌ ‌The‌ ‌company‌ ‌was‌ ‌incorporated‌ ‌in‌ ‌France‌ ‌in‌ ‌the‌ ‌year‌ ‌2012‌ ‌and‌ ‌its‌‌
operations‌ ‌extended‌ ‌to‌ ‌countries‌ ‌beyond‌ ‌the‌ ‌European‌ ‌Union.‌ ‌Infinity‌ ‌Analytics‌ ‌in‌ ‌its‌‌
endeavour‌ ‌to‌ ‌explore‌ ‌niche‌ ‌markets‌ ‌has‌ ‌partnered‌ ‌with‌ ‌the‌ ‌Research‌ ‌Wing‌ ‌of‌ ‌a‌‌
Government‌ ‌University‌ ‌headed‌ ‌by‌ ‌Professor‌ ‌Walter‌‌Stefan‌‌who‌‌has‌‌great‌‌experience‌‌in‌‌
academic‌ ‌research.‌ ‌Professor‌ ‌Walter‌ ‌Stefan‌ ‌has‌ ‌developed‌ ‌a‌ ‌platform‌ ‌known‌ ‌as‌ ‌the‌‌
Brainbook‌ ‌for‌ ‌the‌ ‌purpose‌ ‌of‌ ‌collecting‌ ‌information‌ ‌and‌ ‌data‌ ‌for‌ ‌his‌ ‌research.‌ ‌Prof‌‌
Walter,‌ ‌for‌ ‌his‌ ‌research‌ ‌project‌ ‌on‌ ‌consumer‌ ‌preferences,‌ ‌designed‌ ‌a‌ ‌questionnaire‌ ‌and‌‌
conducted‌ ‌a‌ ‌survey‌ ‌using‌ ‌the‌ ‌Brainbook‌ ‌platform‌ ‌to‌ ‌understand‌ ‌personality‌ ‌traits‌ ‌and‌‌
collected‌ ‌information‌ ‌from‌‌various‌‌stakeholders‌‌across‌‌the‌‌European‌‌Union.‌‌The‌‌survey‌‌
had‌ ‌a‌‌catch‌‌that‌‌every‌‌stakeholder‌‌who‌‌participated‌‌in‌‌the‌‌survey‌‌had‌‌to‌‌login‌‌or‌‌signup‌‌
through‌‌Brainbook,‌‌and‌‌all‌‌the‌‌personal‌‌information‌‌of‌‌the‌‌stakeholders‌‌was‌‌stored‌‌in‌‌the‌‌
Brainbook.‌‌ ‌
Prof.‌ ‌Walter’s‌ ‌survey‌ ‌was‌ ‌for‌ ‌the‌ ‌purpose‌ ‌of‌ ‌academic‌ ‌research.‌ ‌Prof‌ ‌Walter‌‌
shared‌‌the‌‌data‌‌harvested‌‌with‌‌Infinity‌‌Analytics‌‌as‌‌per‌‌the‌‌agreement‌‌with‌‌the‌‌Research‌‌
Wing‌‌of‌‌the‌‌University‌‌without‌‌the‌‌knowledge‌‌and‌‌consent‌‌of‌‌the‌‌people‌‌being‌‌surveyed.‌‌
The‌ ‌user’s‌ ‌data‌ ‌harvested‌ ‌was‌ ‌strategically‌ ‌collected‌ ‌from‌ ‌individuals‌ ‌of‌ ‌different‌‌
professions‌ ‌including‌ ‌political‌ ‌parties,‌ ‌social‌ ‌and‌ ‌philanthropic‌ ‌organizations,‌ ‌business‌‌
houses,‌ ‌medical‌‌professionals‌‌and‌‌others‌‌in‌‌addition‌‌to‌‌the‌‌employees‌‌and‌‌students.‌‌The‌‌
information‌ ‌collected‌ ‌spread‌ ‌over‌ ‌a‌ ‌period‌ ‌of‌ ‌2‌ ‌years.‌ ‌Prof‌ ‌Walter‌ ‌developed‌ ‌an‌‌
application‌ ‌called‌ ‌“your‌ ‌life”‌ ‌on‌ ‌the‌‌advice‌‌of‌‌the‌‌Directors‌‌of‌‌Infinity‌‌Analytics‌‌which‌‌
could‌ ‌be‌ ‌used‌ ‌on‌ ‌the‌ ‌Brainbook.‌ ‌The‌ ‌data‌ ‌collected‌ ‌through‌ ‌Brainbook‌ ‌was‌ ‌analyzed‌‌
according‌‌to‌‌their‌‌personality,‌‌location,‌‌taste‌‌&‌‌habits‌‌and‌‌their‌‌political‌‌affiliations.‌‌The‌‌
information‌ ‌gathered‌ ‌through‌ ‌‘your‌ ‌life’‌ ‌app‌ ‌from‌ ‌the‌ ‌users‌ ‌of‌ ‌Brainbook‌ ‌was‌ ‌sold‌ ‌to‌‌
Infinity‌‌Analytics‌‌as‌‌per‌‌the‌‌terms‌‌agreed‌‌earlier.‌ ‌
‌Mr.‌ ‌Bob‌ ‌Bradley,‌ ‌a‌ ‌former‌ ‌employee‌ ‌of‌ ‌Infinity‌ ‌Analytics,‌ ‌through‌ ‌an‌‌
unidentified‌ ‌source‌ ‌presented‌ ‌an‌ ‌Article‌ ‌in‌ ‌a‌‌famous‌‌newspaper‌‌“The‌‌Next”‌‌which‌‌was‌‌
titled‌ ‌“The‌ ‌Great‌ ‌Robbery‌ ‌of‌ ‌Data”.‌ ‌Mr.‌ ‌Bob‌ ‌went‌ ‌onto‌ ‌National‌ ‌Television‌ ‌and‌‌
presented‌‌his‌‌grievance‌‌and‌‌objection‌‌on‌‌the‌‌procuring‌‌of‌‌data‌‌through‌‌data‌‌mining,‌‌data‌‌
analysis‌‌and‌‌misuse‌‌of‌‌the‌‌same‌‌by‌‌Prof‌‌Walter‌‌for‌‌commercial‌‌purpose.‌‌ ‌
‌In‌‌response‌‌to‌‌the‌‌allegations‌‌made‌‌through‌‌media,‌‌the‌‌CEO‌‌of‌‌the‌‌Brainbook‌‌has‌‌
categorically‌ ‌stated‌ ‌that‌ ‌there‌ ‌was‌ ‌no‌ ‌data‌ ‌breach‌ ‌since‌ ‌no‌ ‌passwords‌ ‌were‌ ‌stolen‌ ‌and‌‌
used.‌ ‌It‌ ‌has‌ ‌been‌ ‌used‌ ‌as‌ ‌per‌ ‌the‌ ‌agreement‌ ‌with‌ ‌Brainbook‌ ‌and‌ ‌the‌ ‌application‌ ‌‘Your‌‌
Life’‌‌is‌‌developed‌‌by‌‌Prof‌‌Walter‌‌as‌‌per‌‌their‌‌request.‌‌He‌‌also‌‌assured‌‌that‌‌if‌‌required‌‌it‌‌
would‌‌develop‌‌an‌‌app‌‌to‌‌force‌‌delete‌‌all‌‌Brainbook‌‌web‌‌search‌‌data‌‌by‌‌its‌‌users.‌‌He‌‌also‌‌
assured‌‌to‌‌appoint‌‌an‌‌agency‌‌to‌‌investigate‌‌into‌‌the‌‌matter‌‌and‌‌submit‌‌a‌‌report.‌‌ ‌
A‌ ‌case‌ ‌was‌ ‌filed‌ ‌against‌ ‌Brainbook,‌ ‌Infinity‌ ‌Analytics‌‌and‌‌Mr.‌‌Walter‌‌Stefan‌‌in‌‌
the‌‌European‌‌Court‌‌of‌‌Justice‌‌alleging‌‌that‌‌they‌‌had‌‌violated‌‌the‌‌data‌‌privacy‌‌of‌‌millions‌‌
of‌‌users‌‌wherein‌‌Infinity‌‌Analytics‌‌declared‌‌bankruptcy‌‌and‌‌contested‌‌that‌‌they‌‌followed‌‌
the‌ ‌standard‌‌component‌‌of‌‌online‌‌promotion‌‌in‌‌all‌‌areas‌‌and‌‌the‌‌allegations‌‌made‌‌under‌‌
GDPR‌ ‌were‌ ‌unfounded.‌ ‌The‌ ‌Aggrieved‌ ‌parties‌ ‌approached‌ ‌the‌ ‌authorities‌ ‌in‌ ‌the‌‌
European‌ ‌Union‌ ‌to‌ ‌put‌ ‌forth‌ ‌the‌ ‌matter‌ ‌and‌ ‌to‌ ‌appeal‌ ‌for‌ ‌relief‌ ‌with‌ ‌regard‌ ‌to‌ ‌the‌‌
provisions‌ ‌of‌ ‌GDPR.‌ ‌The‌ ‌illegal‌ ‌harvesting‌ ‌of‌ ‌data‌ ‌by‌ ‌the‌‌Brainbook‌‌platform‌‌was‌‌not‌‌
limited‌ ‌to‌ ‌France‌ ‌and‌ ‌the‌ ‌European‌ ‌Union,‌ ‌but‌‌it‌‌reached‌‌other‌‌countries‌‌like‌‌Indisthan‌‌
and‌‌Desertistan.‌‌The‌‌Government‌‌of‌‌Indisthan‌‌on‌‌the‌‌floor‌‌of‌‌its‌‌Parliament‌‌said‌‌that‌‌the‌‌
matters‌ ‌on‌ ‌illegal‌ ‌harvesting‌ ‌of‌ ‌personal‌ ‌data‌ ‌should‌ ‌be‌ ‌investigated‌ ‌into.‌ ‌The‌ ‌illegal‌‌
harvesting‌‌of‌‌data‌‌has‌‌been‌‌handed‌‌over‌‌to‌‌the‌‌Indisthan‌‌Bureau‌‌of‌‌Investigation‌‌to‌‌probe‌‌
into‌‌the‌‌matter.‌‌ ‌
The‌ ‌Indisthan‌ ‌Bureau‌ ‌of‌ ‌Investigation‌ ‌has‌ ‌registered‌ ‌FIR‌ ‌against‌ ‌Infinity‌‌
Analytics‌ ‌&‌ ‌Mr.‌ ‌Walter‌ ‌Stefan‌ ‌under‌ ‌the‌ ‌Indisthan‌ ‌Information‌ ‌Technology‌ ‌Act‌ ‌and‌‌
accused‌ ‌both‌ ‌the‌ ‌parties‌ ‌of‌ ‌criminal‌ ‌conspiracy‌ ‌under‌ ‌relevant‌ ‌statutes‌ ‌including‌ ‌the‌‌
Information‌‌Technology‌‌Law‌‌and‌‌Penal‌‌laws‌‌in‌‌Indisthan.‌‌The‌‌case‌‌which‌‌has‌‌been‌‌filed‌‌
under‌ ‌the‌ ‌provisions‌ ‌of‌ ‌the‌ ‌Indisthan‌ ‌Information‌ ‌Technology‌ ‌Act‌ ‌2000‌ ‌after‌ ‌the‌‌
allegations‌ ‌were‌ ‌made‌ ‌public‌‌in‌‌the‌‌year‌‌2018.‌‌The‌‌matter‌‌reached‌‌the‌‌Special‌‌Court‌‌of‌‌
Indisthan‌‌Bureau‌‌of‌‌Investigation,‌‌and‌‌has‌‌taken‌‌cognizance‌‌and‌‌accepted‌‌the‌‌facts‌‌of‌‌the‌‌
case.‌‌The‌‌special‌‌court‌‌upheld‌‌the‌‌allegations‌‌made‌‌by‌‌Indisthan‌‌Bureau‌‌of‌‌Investigation‌‌
 and‌‌held‌‌that‌‌the‌‌companies‌‌and‌‌Mr.‌‌Walter‌‌Stefan‌‌liable‌‌under‌‌the‌‌Indisthan‌‌Information‌‌
Technology‌‌Act‌‌2000‌‌and‌‌Indisthan‌‌Penal‌‌Code‌‌1860.‌ ‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
 ISSUES‌‌RAISED‌ ‌
‌
‌
1.‌ ‌Whether‌ ‌the‌ ‌act‌ ‌of‌ ‌Infinity‌ ‌Analytics‌ ‌and‌ ‌others‌ ‌amounts‌ ‌to‌ ‌cheating‌ ‌under‌ ‌section‌ ‌420‌ ‌of‌‌
Indisthan‌‌Penal‌‌Code‌‌1860?‌ ‌
‌2.‌‌Whether‌‌the‌‌act‌‌of‌‌Infinity‌‌Analytics‌‌and‌‌others‌‌amount‌‌to‌‌the‌‌violation‌‌of‌‌Data‌‌privacy‌‌under‌‌
the‌‌provisions‌‌of‌‌Indisthan‌‌Information‌‌Technology‌‌Act‌‌2000?‌ ‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
‌
 JUDGEMENT‌ ‌
‌
In‌ ‌the‌ ‌case‌ ‌in‌ ‌hand,‌ ‌there‌ ‌are‌ ‌two‌ ‌issues‌ ‌to‌ ‌be‌ ‌dealt‌ ‌with‌ ‌by‌ ‌hearing‌ ‌the‌ ‌learned‌ ‌counsels‌‌
arguments‌‌and‌‌contentions,‌‌the‌‌court‌‌has‌‌reached‌‌the‌‌following‌‌observations‌‌and‌‌conclusions.‌ ‌
‌
Issue‌‌1:‌‌Whether‌‌the‌‌act‌‌of‌‌Infinity‌‌Analytics‌‌and‌‌others‌‌amounts‌‌to‌‌cheating‌‌under‌‌section‌‌
420‌‌of‌‌Indisthan‌‌Penal‌‌Code‌‌1860?.‌ ‌
Cheating‌‌is‌‌defined‌‌under‌‌Section‌‌415‌‌of‌‌the‌‌Indian‌‌Penal‌‌Code‌‌as‌‌whoever‌‌fraudulently‌‌
or‌‌dishonestly‌‌deceives‌‌a‌‌person‌‌in‌‌order‌‌to‌‌induce‌‌that‌‌person‌‌to‌‌deliver‌‌a‌‌property‌‌to‌‌any‌‌person‌‌
or‌‌to‌‌consent‌‌to‌‌retain‌‌any‌‌property.‌‌If‌‌a‌‌person‌‌intentionally‌‌induces‌‌a‌‌person‌‌to‌‌do‌‌or‌‌omit‌‌to‌‌do‌‌
any‌ ‌act‌ ‌which‌ ‌he‌ ‌would‌ ‌not‌ ‌have‌ ‌done‌ ‌if‌ ‌he‌ ‌was‌‌not‌‌deceived‌‌to‌‌do‌‌so‌‌and‌‌the‌‌act‌‌has‌‌caused‌‌
harm‌ ‌to‌ ‌that‌ ‌person‌ ‌in‌ ‌body,‌ ‌mind,‌ ‌reputation‌ ‌or‌ ‌property,‌ ‌then‌ ‌the‌ ‌person‌ ‌who‌ ‌fraudulently,‌‌
dishonestly‌‌or‌‌intentionally‌‌induced‌‌the‌‌other‌‌person‌‌is‌‌said‌‌to‌‌cheat.‌‌Any‌‌dishonest‌‌concealment‌‌
of‌ ‌facts‌ ‌that‌ ‌can‌‌deceive‌‌a‌‌person‌‌to‌‌do‌‌an‌‌act‌‌which‌‌he‌‌would‌‌not‌‌have‌‌done‌‌otherwise‌‌is‌‌also‌‌
cheating‌‌within‌‌the‌‌meaning‌‌of‌‌this‌‌section.‌ ‌
The‌‌Appellant's‌‌argued‌‌that‌‌in‌‌this‌‌case,‌‌the‌‌facts‌‌does‌‌not‌‌disclose‌‌the‌‌ingredients‌‌of‌‌the‌‌
1
420‌ ‌IPC.‌ ‌In‌ ‌Hira‌ ‌Lal‌ ‌Hari‌ ‌Lal‌ ‌Bhagwati‌ ‌V.‌ ‌CBI‌ ‌2003‌ ‌this‌ ‌honourable‌ ‌court‌ ‌explains‌ ‌the‌‌
essential‌ ‌ingredients‌ ‌for‌ ‌an‌ ‌offence‌ ‌of‌ ‌cheating.‌ ‌the‌ ‌complainant‌ ‌is‌ ‌required‌ ‌to‌ ‌show‌ ‌that‌ ‌the‌‌
accused‌ ‌had‌ ‌the‌ ‌fraudulent‌ ‌or‌ ‌dishonest‌ ‌intention‌ ‌at‌ ‌the‌ ‌time‌ ‌of‌ ‌making‌ ‌promise‌ ‌or‌‌
representation,‌ ‌in‌ ‌absence‌ ‌of‌ ‌a‌ ‌culpable‌ ‌intention‌ ‌at‌ ‌the‌ ‌time‌ ‌of‌ ‌making‌ ‌initial‌ ‌promise‌ ‌being‌‌
absent,‌ ‌no‌ ‌offence‌ ‌under‌ ‌Section‌ ‌420‌ ‌of‌ ‌the‌ ‌Indian‌‌Penal‌‌Code‌‌can‌‌be‌‌said‌‌to‌‌have‌‌been‌‌made‌‌
out.‌‌ ‌
It‌‌is‌‌settled‌‌law,‌‌by‌‌a‌‌catena‌‌of‌‌decisions,‌‌that‌‌for‌‌establishing‌‌the‌‌offence‌‌of‌‌cheating,‌‌the‌‌
complainant‌‌is‌‌required‌‌to‌‌show‌‌that‌‌the‌‌accused‌‌had‌‌the‌‌fraudulent‌‌or‌‌dishonest‌‌intention‌‌at‌‌the‌‌
time‌ ‌of‌ ‌making‌ ‌promise‌ ‌or‌ ‌representation.‌ ‌From‌ ‌his‌ ‌making‌ ‌failure‌ ‌to‌ ‌keep‌ ‌a‌ ‌promise‌‌
subsequently,‌‌such‌‌a‌‌culpable‌‌intention‌‌right‌‌at‌‌the‌‌beginning‌‌that‌‌is‌‌at‌‌the‌‌time‌‌when‌‌the‌‌promise‌‌
was‌‌made‌‌cannot‌‌be‌‌presumed.‌ ‌

1
‌SCC‌‌(Cri)1121.‌ ‌
 By‌ ‌the‌ ‌arguments‌ ‌of‌ ‌the‌ ‌Respondent‌ ‌counsel,‌ ‌Court‌ ‌understood‌ ‌that‌ ‌the‌ ‌ingredients‌ ‌of‌‌
section‌‌420‌‌IPC‌‌were‌‌present‌‌in‌‌the‌‌instant‌‌issue.‌‌In‌‌this‌‌case,‌‌the‌‌dishonest‌‌intention‌‌is‌‌present.‌‌
The‌ ‌data‌ ‌was‌ ‌collected‌ ‌by‌ ‌saying‌ ‌that‌ ‌it‌ ‌is‌ ‌for‌ ‌academic‌ ‌purposes‌ ‌but‌ ‌he‌ ‌already‌ ‌had‌ ‌an‌‌
agreement‌ ‌with‌ ‌Infinity‌ ‌Analytics‌ ‌to‌ ‌share‌ ‌the‌ ‌harvested‌ ‌data.‌ ‌They‌ ‌have‌ ‌been‌ ‌used‌ ‌the‌ ‌data‌‌
without‌‌the‌‌consent‌‌of‌‌the‌‌respected‌‌people.‌‌ ‌
Even‌ ‌though‌ ‌the‌ ‌information‌ ‌was‌ ‌collected‌ ‌with‌ ‌the‌ ‌consent‌ ‌of‌‌survey‌‌participants,‌‌the‌‌
contract‌ ‌to‌ ‌sell‌ ‌that‌ ‌information‌ ‌to‌ ‌infinity‌ ‌analytics‌ ‌was‌ ‌not‌ ‌known‌ ‌to‌‌them.‌‌Professor‌‌Walter‌‌
also‌‌accessed‌‌the‌‌personal‌‌information‌‌of‌‌Brainbook‌‌users‌‌without‌‌their‌‌permission.‌‌He‌‌collected‌‌
all‌‌the‌‌information‌‌in‌‌the‌‌name‌‌of‌‌academic‌‌research‌‌without‌‌giving‌‌any‌‌consideration‌‌to‌‌the‌‌data‌‌
providers.‌‌But‌‌he‌‌sold‌‌those‌‌data‌‌to‌‌infinity‌‌analytics‌‌based‌‌on‌‌the‌‌prior‌‌contract‌‌having‌‌absolute‌‌
consideration.‌‌It‌‌is‌‌enough‌‌to‌‌establish‌‌the‌‌existence‌‌of‌‌intention.‌‌The‌‌data‌‌transfer‌‌was‌‌continued‌‌
for‌‌a‌‌period‌‌of‌‌two‌‌years‌‌till‌‌the‌‌issue‌‌came‌‌out.‌‌This‌‌was‌‌hidden‌‌by‌‌the‌‌professor‌‌and‌‌the‌‌firm.‌‌It‌‌
constitutes‌‌the‌‌extant‌‌of‌‌dishonest‌‌intention‌‌and‌‌criminal‌‌breach‌‌of‌‌trust.‌‌Therefore‌‌‌the‌‌actions‌‌of‌‌
Infinity‌‌Analytics‌‌&‌‌others‌‌amount‌‌to‌‌cheating‌‌under‌‌section‌‌420‌‌IPC.‌ ‌
‌
‌
Issue‌‌2:‌‌Whether‌‌the‌‌act‌‌of‌‌Infinity‌‌Analytics‌‌and‌‌others‌‌amount‌‌to‌‌the‌‌violation‌‌of‌‌Data‌
privacy‌‌under‌‌the‌‌provisions‌‌of‌‌Indisthan‌‌Information‌‌Technology‌‌Act‌‌2000?‌ ‌

Under‌ ‌Section‌‌43A‌‌of‌‌the‌‌(Indian)‌‌Information‌‌Technology‌‌Act,‌‌2000,‌‌a‌‌body‌‌corporate‌‌
who‌ ‌is‌ ‌possessing,‌ ‌dealing‌ ‌or‌ ‌handling‌ ‌any‌ ‌sensitive‌ ‌personal‌ ‌data‌ ‌or‌ ‌information,‌ ‌and‌ ‌is‌‌
negligent‌ ‌in‌ ‌implementing‌ ‌and‌ ‌maintaining‌ ‌reasonable‌ ‌security‌ ‌practices‌ ‌resulting‌ ‌in‌ ‌wrongful‌‌
loss‌‌or‌‌wrongful‌‌gain‌‌to‌‌any‌‌person,‌‌then‌‌such‌‌body‌‌corporate‌‌may‌‌be‌‌held‌‌liable‌‌to‌‌pay‌‌damages‌‌
to‌‌the‌‌person.‌ ‌

Under‌ ‌Section‌ ‌72A‌ ‌of‌ ‌the‌ ‌(Indian)‌ ‌Information‌ ‌Technology‌ ‌Act,‌ ‌2000,‌ ‌disclosure‌ ‌of‌‌
information,‌ ‌knowingly‌ ‌and‌ ‌intentionally,‌ ‌without‌ ‌the‌ ‌consent‌ ‌of‌ ‌the‌ ‌person‌ ‌concerned‌ ‌and‌ ‌in‌
breach‌ ‌of‌ ‌the‌ ‌lawful‌ ‌contract‌ ‌has‌ ‌been‌ ‌also‌ ‌made‌ ‌punishable‌ ‌with‌ ‌imprisonment‌ ‌for‌ ‌a‌ ‌term‌‌
extending‌ ‌to‌‌three‌‌years‌‌and‌‌fine‌‌extending‌‌to‌‌INR5,00,000‌‌(Approx.‌‌US$10750)‌‌Section‌‌75‌‌of‌‌
the‌‌IT‌‌Act‌‌stipulates‌‌that‌‌the‌‌provisions‌‌of‌‌the‌‌IT‌‌Act‌‌shall‌‌apply‌‌to‌‌an‌‌offence‌‌or‌‌contravention‌‌
committed‌ ‌outside‌ ‌India‌ ‌by‌ ‌any‌ ‌person‌ ‌if‌ ‌the‌ ‌act‌ ‌or‌ ‌conduct‌ ‌constituting‌ ‌an‌ ‌offence‌ ‌or‌‌
contravention‌‌involves‌‌a‌‌computer,‌‌computer‌‌system‌‌or‌‌computer‌‌network‌‌located‌‌in‌‌India.‌ ‌

The‌ ‌Information‌ ‌Technology‌ ‌(Reasonable‌ ‌Security‌ ‌Practices‌ ‌and‌ ‌Procedures‌ ‌and‌

Sensitive‌ ‌Personal‌ ‌Data‌ ‌or‌ ‌Information)‌ ‌Rules,‌ ‌2011,‌ ‌safeguard‌ ‌"sensitive‌ ‌personal‌ ‌data‌ ‌or‌‌
information‌‌of‌‌a‌‌person,"‌‌which‌‌includes‌‌information‌‌about:‌ ‌

a.‌ ‌Passwords;‌ ‌b.‌ ‌Financial‌ ‌information,‌ ‌such‌ ‌as‌ ‌bank‌ ‌account,‌ ‌credit‌ ‌or‌ ‌debit‌ ‌card,‌ ‌or‌ ‌other‌‌
payment‌ ‌instrument‌ ‌details;‌ ‌c.‌ ‌Sexual‌ ‌orientation;‌ ‌d.‌ ‌Medical‌ ‌records‌ ‌and‌ ‌history;‌ ‌and‌ ‌e.‌‌
Biometric‌‌data.‌ ‌

The‌‌information‌‌collected‌‌should‌‌only‌‌be‌‌used‌‌for‌‌the‌‌purpose‌‌for‌‌which‌‌it‌‌was‌‌acquired,‌‌
according‌ ‌to‌ ‌SPDI‌ ‌Rules.‌ ‌However,‌ ‌the‌ ‌information‌ ‌was‌ ‌gathered‌ ‌for‌ ‌academic‌ ‌purposes.‌‌
Despite‌‌the‌‌lack‌‌of‌‌comprehensive‌‌data‌‌protection‌‌laws‌‌in‌‌India,‌‌data‌‌protection‌‌is‌‌guaranteed‌‌by‌‌
the‌‌country's‌‌constitution.‌‌The‌‌Constitution‌‌is‌‌the‌‌country's‌‌fundamental‌‌law.‌ ‌

In‌ ‌the‌ ‌matter‌ ‌of‌ ‌People's‌ ‌Union‌ ‌for‌ ‌Civil‌ ‌Liberties‌ ‌(PUCL)‌ ‌versus‌ ‌Union‌‌of‌‌India‌‌(SC,‌‌
1997),‌‌the‌‌Supreme‌‌Court‌‌of‌‌India‌‌issued‌‌a‌‌decision‌‌in‌‌1997.‌‌which‌‌laid‌‌the‌‌groundwork‌‌for‌‌the‌‌
right‌ ‌to‌ ‌privacy‌ ‌in‌ ‌the‌ ‌context‌ ‌of‌ ‌telephonic‌ ‌surveillance‌ ‌(i.e.wiretaps)‌ ‌and‌ ‌constitutional‌‌
freedom.‌ ‌

People's‌ ‌personal‌ ‌information‌ ‌was‌ ‌sold‌ ‌to‌ ‌a‌ ‌third‌ ‌party‌ ‌without‌ ‌their‌ ‌knowledge‌ ‌or‌‌
consent.‌ ‌It‌ ‌is‌ ‌a‌ ‌breach‌ ‌of‌ ‌the‌ ‌right‌ ‌to‌ ‌privacy‌ ‌guaranteed‌ ‌by‌ ‌the‌ ‌Indisthan‌ ‌Constitution.‌ ‌The‌‌
Indisthan‌ ‌Constitution‌ ‌protects‌ ‌data‌ ‌privacy‌ ‌by‌ ‌recognising‌ ‌the‌ ‌right‌ ‌to‌ ‌privacy.‌ ‌The‌ ‌right‌ ‌to‌‌
privacy‌ ‌has‌ ‌been‌ ‌declared‌ ‌an‌ ‌inherent‌ ‌part‌‌of‌‌Article‌‌21‌‌by‌‌the‌‌Supreme‌‌Court,‌‌which‌‌protects‌‌
private‌‌data‌‌as‌‌a‌‌citizen's‌‌private‌‌property.‌‌Because‌‌the‌‌database's‌‌protection‌‌is‌‌under‌‌the‌‌right‌‌to‌
livelihood,‌‌it‌‌cannot‌‌be‌‌infringed‌‌or‌‌taken‌‌away‌‌unless‌‌it‌‌is‌‌done‌‌so‌‌in‌‌accordance‌‌with‌‌the‌‌law.‌ ‌

Furthermore,‌ ‌the‌ ‌existing‌ ‌legal‌ ‌framework‌ ‌respects‌ ‌an‌ ‌individual's‌ ‌unrestricted‌ ‌right‌ ‌to‌‌
his‌‌or‌‌her‌‌private‌‌property,‌‌which‌‌no‌‌one‌‌may‌‌violate,‌‌and‌‌which‌‌no‌‌one‌‌can‌‌strip‌‌the‌‌citizen‌‌of‌‌
except‌‌via‌‌due‌‌process‌‌of‌‌law.‌‌As‌‌a‌‌result,‌‌one's‌‌data‌‌is‌‌protected‌‌under‌‌article‌‌21.‌ ‌
Hence‌‌the‌‌act‌‌of‌‌Infinity‌‌Analytics‌‌and‌‌other‌ ‌amounts‌‌to‌‌the‌‌violation‌‌of‌‌Data‌‌privacy‌‌under‌‌the‌‌
provision‌‌of‌‌Indisthan‌‌Information‌‌Technology‌‌Act‌‌2000‌‌liable‌‌for‌‌a‌‌penalty‌‌of‌‌500000‌‌as‌‌per‌‌the‌‌
section‌‌75A‌‌of‌‌information‌‌technology‌‌act‌‌2000.‌ ‌

(Signed)‌‌ ‌

JISHIN‌‌JAFAR‌‌T‌‌(Judge0‌ ‌

(Signed)‌ ‌

‌KISHORE‌‌RAJ‌‌R.S‌‌(Judge)‌ ‌

______________________________________________________________________________‌ ‌